5 ms·

It's often overlooked how including external Javascript impacts the security of your website (see also the recent Healthcare.gov information leak). It's not ju

by agwa 12y ago

It's often overlooked how including external Javascript impacts the security of your website (see also the recent Healthcare.gov information leak). It's not just the external sites' TLS configuration you have to worry about, but all their security and privacy practices. Even if piwikpro.com had had a perfect TLS configuration, if an attacker had been able to compromise (or corrupt/coerce) them, the attacker would have been able to execute arbitrary Javascript on NSW's online voting website. Stripe is the only external Javascript I load on my websites. I trust Stripe a lot more than most, but still I would prefer not to load their Javascript. This policy is frustrating because it means I can't use a lot of cool tools, but I care too much about security and the privacy of my visitors to do otherwise.

ams6110 12y ago
An online voting site should not use javascript. Period. It should be bare-bones simplest possible HTML form posting with all validation and logic happening server-side. For one thing it needs to be accessible to disabled voters and the more complex the UI implementation, the less accessible it will be. Also for security peace of mind it should be usable with all scripting and plugins disabled. A ballot is not a complex UI. A basic HTML form with checkboxes and/or radio buttons is all that's needed.
- lazaroclapp 12y ago
  Not necessarily true. Ideally you want things like vote encryption and confirmation code generation to occur in the client, where they can be verified by the voters themselves. Otherwise, who is to say the election server itself is not compromised or outright designed to manipulate results. Of course, this is only useful paired with a voting protocol that allows verifying that your own vote was counted, while obscuring its association with any individual voter. See [1]. This is helpful even if only a tiny fraction of voters do verify it, say by running a browser extension that checksums the downloaded Javascript. Because of birthday paradox like results, if votes are verifiable, and a small percentage of voters properly verify their votes, then the chances that the server can modify the election results significantly (e.g. by shipping malicious javascript to some users) without being caught, are actually fairly small. [1] https://www.usenix.org/legacy/events/sec08/tech/full_papers/adida/adida.pdf https://www.usenix.org/legacy/events/sec08/tech/full_papers/... p.s. Of course, an issue with this system is that voters voting on a compromised computer might have their votes hijacked anyways (which is true of any remote voting protocol I know), and that verification codes aid in things like vote selling (some solutions exist, using verification code decoys and the like).
  - superuser2 12y ago
    > who is to say the election server itself is not compromised or outright designed to manipulate results Not Javascript. http://matasano.com/articles/javascript-cryptography/ http://matasano.com/articles/javascript-cryptography/
    - lazaroclapp 12y ago
      Javascript is downloaded by the client and can be verified by the client. I know the server can serve malicious Javascript, but then a client extension can check it. If the server doesn't know which clients are performing verification and which aren't, then it risks being found out. And yes, that article mentions that it's safer to perform the entire protocol in an extension. But the point of the "verifier extension" is that then you don't need every user to use a modified browser[1], just a threshold number of users. It would be even better if browsers provided decent crypto primitives and more compartmentalized runtimes, of course. The point of client side processing here can be seen, if you want as "open sourcing the code that will actually handle my vote" vs "open sourcing some code and promising that it is the code that will handle my vote". Even with the limitations of Javascript security, the former is better than the later, and the later is better than closed source in the server, which is the present situation. Arguably a dedicated (phone?) app would be better and dedicated hardware even better[2]. But then you have to deal with rolling that out to tens or hundreds of millions of people. [1] Chrome extensions are usually also partially compartmentalized Javascript. [2] http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html http://googleprojectzero.blogspot.com/2015/03/exploiting-dra...
- caf 12y ago
  New South Wales, where this election is being conducted, does actually need a slightly more complex UI: it uses "optional preferential voting", requiring voters to number the candidates in order of preference from 1, stopping at any point after that. (The upper house ballot also has the option of numbering either the group boxes above the line, or the individual candidate boxes below). Not that that requires Javascript, either.
  - thret 12y ago
    The online voting form should still allow for people to ignore the rules and submit an invalid vote though, just like they can with pencil and paper.
    - aaron695 12y ago
      Although it is not illegal to vote informally, it does not follow you have a legal right to vote informally.
      - meric 12y ago
        Of course it does. Following that argument: It isn't illegal to run on the streets, it does not follow you have a legal right to run on the streets? Clearly absurd. The population's rights include all except what is expressly forbidden by the laws, and the government's rights include none except what is expressly enumerated in law.
        robzyb 12y ago
        > It isn't illegal to run on the streets, it does not follow you have a legal right to run on the streets? It does NOT follow thaty ou have a legal right to run in the streets. It some entity declared a street to be walking-only, then you could not claim "WAH! I HAVE A RIGHT TO RUN IN STREETS!" Similarly, if an entity will only allow you to submit votes that are "correct" as per the definition of preferential voting, you can not claim "WAH! I HAVE A RIGHT TO SUBMIT INFORMAL VOTES!"
- userbinator 12y ago
  the site included additional JavaScript from an external server, ivote.piwikpro.com. (Piwik is an analytics tool used to track site visitors.) What is really disturbing is that this JS is not even tangentially related in any way to the actual voting process. Why does a voting site need to track its visitors at all?!

by agwa 12y ago

ams6110 12y ago

An online voting site should not use javascript. Period. It should be bare-bones simplest possible HTML form posting with all validation and logic happening server-side. For one thing it needs to be accessible to disabled voters and the more complex the UI implementation, the less accessible it will be. Also for security peace of mind it should be usable with all scripting and plugins disabled. A ballot is not a complex UI. A basic HTML form with checkboxes and/or radio buttons is all that's needed.

lazaroclapp 12y ago
Not necessarily true. Ideally you want things like vote encryption and confirmation code generation to occur in the client, where they can be verified by the voters themselves. Otherwise, who is to say the election server itself is not compromised or outright designed to manipulate results. Of course, this is only useful paired with a voting protocol that allows verifying that your own vote was counted, while obscuring its association with any individual voter. See [1]. This is helpful even if only a tiny fraction of voters do verify it, say by running a browser extension that checksums the downloaded Javascript. Because of birthday paradox like results, if votes are verifiable, and a small percentage of voters properly verify their votes, then the chances that the server can modify the election results significantly (e.g. by shipping malicious javascript to some users) without being caught, are actually fairly small. [1] https://www.usenix.org/legacy/events/sec08/tech/full_papers/adida/adida.pdf https://www.usenix.org/legacy/events/sec08/tech/full_papers/... p.s. Of course, an issue with this system is that voters voting on a compromised computer might have their votes hijacked anyways (which is true of any remote voting protocol I know), and that verification codes aid in things like vote selling (some solutions exist, using verification code decoys and the like).
- superuser2 12y ago
  > who is to say the election server itself is not compromised or outright designed to manipulate results Not Javascript. http://matasano.com/articles/javascript-cryptography/ http://matasano.com/articles/javascript-cryptography/
  - lazaroclapp 12y ago
    Javascript is downloaded by the client and can be verified by the client. I know the server can serve malicious Javascript, but then a client extension can check it. If the server doesn't know which clients are performing verification and which aren't, then it risks being found out. And yes, that article mentions that it's safer to perform the entire protocol in an extension. But the point of the "verifier extension" is that then you don't need every user to use a modified browser[1], just a threshold number of users. It would be even better if browsers provided decent crypto primitives and more compartmentalized runtimes, of course. The point of client side processing here can be seen, if you want as "open sourcing the code that will actually handle my vote" vs "open sourcing some code and promising that it is the code that will handle my vote". Even with the limitations of Javascript security, the former is better than the later, and the later is better than closed source in the server, which is the present situation. Arguably a dedicated (phone?) app would be better and dedicated hardware even better[2]. But then you have to deal with rolling that out to tens or hundreds of millions of people. [1] Chrome extensions are usually also partially compartmentalized Javascript. [2] http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html http://googleprojectzero.blogspot.com/2015/03/exploiting-dra...
caf 12y ago
New South Wales, where this election is being conducted, does actually need a slightly more complex UI: it uses "optional preferential voting", requiring voters to number the candidates in order of preference from 1, stopping at any point after that. (The upper house ballot also has the option of numbering either the group boxes above the line, or the individual candidate boxes below). Not that that requires Javascript, either.
- thret 12y ago
  The online voting form should still allow for people to ignore the rules and submit an invalid vote though, just like they can with pencil and paper.
  - aaron695 12y ago
    Although it is not illegal to vote informally, it does not follow you have a legal right to vote informally.
    - meric 12y ago
      Of course it does. Following that argument: It isn't illegal to run on the streets, it does not follow you have a legal right to run on the streets? Clearly absurd. The population's rights include all except what is expressly forbidden by the laws, and the government's rights include none except what is expressly enumerated in law.
      - robzyb 12y ago
        > It isn't illegal to run on the streets, it does not follow you have a legal right to run on the streets? It does NOT follow thaty ou have a legal right to run in the streets. It some entity declared a street to be walking-only, then you could not claim "WAH! I HAVE A RIGHT TO RUN IN STREETS!" Similarly, if an entity will only allow you to submit votes that are "correct" as per the definition of preferential voting, you can not claim "WAH! I HAVE A RIGHT TO SUBMIT INFORMAL VOTES!"
userbinator 12y ago
the site included additional JavaScript from an external server, ivote.piwikpro.com. (Piwik is an analytics tool used to track site visitors.) What is really disturbing is that this JS is not even tangentially related in any way to the actual voting process. Why does a voting site need to track its visitors at all?!